| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20251118134639.3314803-14-ivanov.mikhail1@huawei-partners.com>
Date: Tue, 18 Nov 2025 21:46:33 +0800
From: Mikhail Ivanov <ivanov.mikhail1@...wei-partners.com>
To: <mic@...ikod.net>, <gnoack@...gle.com>
CC: <willemdebruijn.kernel@...il.com>, <matthieu@...fet.re>,
<linux-security-module@...r.kernel.org>, <netdev@...r.kernel.org>,
<netfilter-devel@...r.kernel.org>, <yusongping@...wei.com>,
<artem.kuzin@...wei.com>, <konstantin.meskhidze@...wei.com>
Subject: [RFC PATCH v4 13/19] selftests/landlock: Test SCTP peeloff restriction
It is possible to branch off an SCTP UDP association into a separate
user space UDP socket. Add test validating that such scenario is
restricted by Landlock.
Move setup_loopback() helper from net_test to common.h to use it to
enable connection in this test.
Signed-off-by: Mikhail Ivanov <ivanov.mikhail1@...wei-partners.com>
---
Changes since v3:
* Restricts branching off SCTP association.
* Changes commit message.
* Chages fixture from socket_create to mini.
---
tools/testing/selftests/landlock/common.h | 13 ++
tools/testing/selftests/landlock/net_test.c | 11 --
.../testing/selftests/landlock/socket_test.c | 128 ++++++++++++++++++
3 files changed, 141 insertions(+), 11 deletions(-)
diff --git a/tools/testing/selftests/landlock/common.h b/tools/testing/selftests/landlock/common.h
index e9378a229a4c..ff1b7fc94a5b 100644
--- a/tools/testing/selftests/landlock/common.h
+++ b/tools/testing/selftests/landlock/common.h
@@ -16,6 +16,7 @@
#include <sys/un.h>
#include <sys/wait.h>
#include <unistd.h>
+#include <sched.h>
#include "../kselftest_harness.h"
#include "wrappers.h"
@@ -255,3 +256,15 @@ static void __maybe_unused set_unix_address(struct service_fixture *const srv,
srv->unix_addr_len = SUN_LEN(&srv->unix_addr);
srv->unix_addr.sun_path[0] = '\0';
}
+
+static void __maybe_unused
+setup_loopback(struct __test_metadata *const _metadata)
+{
+ set_cap(_metadata, CAP_SYS_ADMIN);
+ ASSERT_EQ(0, unshare(CLONE_NEWNET));
+ clear_cap(_metadata, CAP_SYS_ADMIN);
+
+ set_ambient_cap(_metadata, CAP_NET_ADMIN);
+ ASSERT_EQ(0, system("ip link set dev lo up"));
+ clear_ambient_cap(_metadata, CAP_NET_ADMIN);
+}
diff --git a/tools/testing/selftests/landlock/net_test.c b/tools/testing/selftests/landlock/net_test.c
index 2a45208551e6..a71ea275cf10 100644
--- a/tools/testing/selftests/landlock/net_test.c
+++ b/tools/testing/selftests/landlock/net_test.c
@@ -75,17 +75,6 @@ static int set_service(struct service_fixture *const srv,
return 1;
}
-static void setup_loopback(struct __test_metadata *const _metadata)
-{
- set_cap(_metadata, CAP_SYS_ADMIN);
- ASSERT_EQ(0, unshare(CLONE_NEWNET));
- clear_cap(_metadata, CAP_SYS_ADMIN);
-
- set_ambient_cap(_metadata, CAP_NET_ADMIN);
- ASSERT_EQ(0, system("ip link set dev lo up"));
- clear_ambient_cap(_metadata, CAP_NET_ADMIN);
-}
-
static bool prot_is_tcp(const struct protocol_variant *const prot)
{
return (prot->domain == AF_INET || prot->domain == AF_INET6) &&
diff --git a/tools/testing/selftests/landlock/socket_test.c b/tools/testing/selftests/landlock/socket_test.c
index d1a004c2e0f5..e9f56a86f456 100644
--- a/tools/testing/selftests/landlock/socket_test.c
+++ b/tools/testing/selftests/landlock/socket_test.c
@@ -12,6 +12,10 @@
#include <linux/pfkeyv2.h>
#include <linux/kcm.h>
#include <linux/can.h>
+#include <sys/socket.h>
+#include <stdint.h>
+#include <linux/sctp.h>
+#include <arpa/inet.h>
#include "common.h"
@@ -921,4 +925,128 @@ TEST_F(mini, socketpair)
EXPECT_EQ(EACCES, test_socketpair(AF_UNIX, SOCK_STREAM, 0));
}
+/* clang-format off */
+FIXTURE(connection_restriction) {};
+/* clang-format on */
+
+FIXTURE_VARIANT(connection_restriction)
+{
+ bool sandboxed;
+};
+
+FIXTURE_SETUP(connection_restriction)
+{
+ disable_caps(_metadata);
+ setup_loopback(_metadata);
+};
+
+FIXTURE_TEARDOWN(connection_restriction)
+{
+}
+
+/* clang-format off */
+FIXTURE_VARIANT_ADD(connection_restriction, allowed) {
+ /* clang-format on */
+ .sandboxed = false,
+};
+
+/* clang-format off */
+FIXTURE_VARIANT_ADD(connection_restriction, sandboxed) {
+ /* clang-format on */
+ .sandboxed = true,
+};
+
+static const char loopback_ipv4[] = "127.0.0.1";
+static const int backlog = 10;
+static const int loopback_port = 1024;
+
+TEST_F(connection_restriction, sctp_peeloff)
+{
+ int status, ret;
+ pid_t child;
+ struct sockaddr_in addr;
+ int server_fd;
+
+ server_fd =
+ socket(AF_INET, SOCK_SEQPACKET | SOCK_CLOEXEC, IPPROTO_SCTP);
+ ASSERT_LE(0, server_fd);
+
+ addr.sin_family = AF_INET;
+ addr.sin_port = htons(loopback_port);
+ addr.sin_addr.s_addr = inet_addr(loopback_ipv4);
+
+ ASSERT_EQ(0, bind(server_fd, &addr, sizeof(addr)));
+ ASSERT_EQ(0, listen(server_fd, backlog));
+
+ child = fork();
+ ASSERT_LE(0, child);
+ if (child == 0) {
+ int client_fd;
+ sctp_peeloff_flags_arg_t peeloff;
+ socklen_t peeloff_size = sizeof(peeloff);
+
+ /* Closes listening socket for the child. */
+ ASSERT_EQ(0, close(server_fd));
+
+ client_fd = socket(AF_INET, SOCK_SEQPACKET | SOCK_CLOEXEC,
+ IPPROTO_SCTP);
+ ASSERT_LE(0, client_fd);
+
+ /*
+ * Establishes connection between sockets and
+ * gets SCTP association id.
+ */
+ ret = setsockopt(client_fd, IPPROTO_SCTP, SCTP_SOCKOPT_CONNECTX,
+ &addr, sizeof(addr));
+ ASSERT_LE(0, ret);
+
+ if (variant->sandboxed) {
+ const struct landlock_ruleset_attr ruleset_attr = {
+ .handled_access_socket =
+ LANDLOCK_ACCESS_SOCKET_CREATE,
+ };
+ /* Denies creation of SCTP sockets. */
+ int ruleset_fd = landlock_create_ruleset(
+ &ruleset_attr, sizeof(ruleset_attr), 0);
+ ASSERT_LE(0, ruleset_fd);
+
+ enforce_ruleset(_metadata, ruleset_fd);
+ ASSERT_EQ(0, close(ruleset_fd));
+ }
+ /*
+ * Branches off current SCTP association into a separate socket
+ * and returns it to user space.
+ */
+ peeloff.p_arg.associd = ret;
+ ret = getsockopt(client_fd, IPPROTO_SCTP, SCTP_SOCKOPT_PEELOFF,
+ &peeloff, &peeloff_size);
+
+ /*
+ * Branching off existing SCTP association leads to creation of user space
+ * SCTP UDP socket and should be restricted by Landlock.
+ */
+ if (variant->sandboxed) {
+ EXPECT_EQ(-1, ret);
+ EXPECT_EQ(EACCES, errno);
+ } else {
+ ASSERT_LE(0, ret);
+ }
+
+ /* getsockopt(2) returns 0 on success. */
+ if (ret == 0) {
+ /* Closes peeloff socket if such was created. */
+ ASSERT_EQ(0, close(peeloff.p_arg.sd));
+ }
+ ASSERT_EQ(0, close(client_fd));
+ _exit(_metadata->exit_code);
+ return;
+ }
+
+ ASSERT_EQ(child, waitpid(child, &status, 0));
+ ASSERT_EQ(1, WIFEXITED(status));
+ ASSERT_EQ(EXIT_SUCCESS, WEXITSTATUS(status));
+
+ ASSERT_EQ(0, close(server_fd));
+}
+
TEST_HARNESS_MAIN
--
2.34.1
Powered by blists - more mailing lists